WireGuard configuration

[gsanchietti]

Description:
This feature introduces WireGuard configuration from both the command line interface (CLI) and the user interface (UI) for the NethSecurity project. It allows administrators to manage multiple WireGuard server instances and their associated peers (accounts) with specific configurations and features.

Features:

• Support for multiple WireGuard server instances
• Each instance has its own reserved zone
• Static IP allocation for all peers (only /24 networks are supported)
• Ability to download peer configuration as text or QR code
• Net-to-net (site-to-site) mode
• Support for peer pre-shared keys
• Link a local or remote user to a given WireGuard account
• Use WireGuard account IP addresses within firewall objects
• Add an API to import configuration files for firewalls used as peers in a net-to-net setup
• Support for UI to create multiple instances of servers
  • If a server is associated with a user database, all accounts must be tied to existing users (similar to OpenVPN RW)
  • If a server is not associated with a user database, it is possible to create custom WireGuard-only users, typically used for connecting multiple sites in point-to-point or star topology
• Support kernel-level debug

References:

• Pull Request #888
• WireGuard iOS App
• WireGuard Android App

[github-actions]

Testing image version: 8-23.05.5-ns.1.3.0-134-g34fcbf2a

[gsanchietti]

Test Case for "Get good defaults"

1. Description: Verify that the default instance parameters are retrieved correctly.
2. Command: /usr/libexec/rpcd/ns.wireguard call get-instance-defaults
3. Expected Result: The response should include parameters like listen_port, instance, network, routes, and public_endpoint.

Test Case for "Create the instance"

1. Description: Create a WireGuard instance with specified parameters and verify its creation.
2. Command: echo '{"listen_port": 51820, "name": "wg1", "instance": "wg1", "enabled": true, "network": "10.103.1.0/24", "routes": ["192.168.100.0/24"], "public_endpoint": "1.2.3.4", "dns": [], "user_db": ""}' | /usr/libexec/rpcd/ns.wireguard call set-instance
3. Expected Result: The instance should be created, and the server should get the first IP of the network, e.g., 10.98.95.1.

Test Case for "Add a new account (peer)"

1. Description: Add a new peer to the instance and verify its addition.
2. Command: echo '{"enabled": true, "instance": "wg1", "account": "user1", "route_all_traffic": false, "client_to_client": false, "ns_routes": [], "preshared_key": true}' | /usr/libexec/rpcd/ns.wireguard call set-peer
3. Expected Result: The peer should be added to the instance with the specified parameters.

Test Case for "Download the account configuration"

1. Description: Download the configuration for a peer account and verify the output.
2. Command: echo '{"instance": "wg1", "account": "user1"}' | /usr/libexec/rpcd/ns.wireguard call download-peer-config | jq -r .config
3. Expected Result: The configuration should be downloaded in text format.

Test Case for "Configure a Desktop/Mobile device"

1. Description: Generate a QR code for a peer account and verify it can be scanned and used.
2. Command: echo '{"instance": "wg1", "account": "user1"}' | /usr/libexec/rpcd/ns.wireguard call download-peer-config | jq -r .qrcode | base64 -d
3. Expected Result: The QR code should be generated and printable.

[cotosso]

TEST CASE for Get Good defaults

root@NSec8-VM:~# /usr/libexec/rpcd/ns.wireguard call get-instance-defaults
{"listen_port": 51820, "instance": "wg1", "network": "10.9.110.0/24", "routes": ["10.77.88.0/24", "192.168.56.0/24"], "public_endpoint": ""}

everything works fine except for the public endpoint which has no value.
Said that if I try to get the public endpoint for OpenVPN (server or RW) I have thew same result, so it seems to be a global issue, not a specific one of WG.

Environment:
Virtual machine going to internet through another firewall.

[cotosso]

TEST CASE for "Create the instance"

root@NSec8-VM:~# echo '{"listen_port": 51820, "name": "wg1", "instance": "wg1", "enabled": true, "network": "10.103.1.0/24", "routes": ["192.168.100.0/24"], "public_endpoint": "1.2.3.4", "dns": [], "user_db": ""}' |  /usr/libexec/rpcd/ns.wireguard call set-instance
{"public_key": "10VNMyuL/4kZz2IGnxlCBFggtxgrXP1IifVZGfuoaBE="}

instance has been created but we need some command more to see the wg interface

uci commit network && uci commit firewall
reload_config

and then everything is fine

10: wg1: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 10.103.1.1/32 brd 255.255.255.255 scope global wg1
       valid_lft forever preferred_lft forever

[cotosso]

Test Case for "Add a new account (peer)"

root@NSec8-VM:~# echo '{"enabled": true, "instance": "wg1", "account": "user1", "route_all_traffic": false, "client_to_client": false, "ns_routes": [], "preshared_key": true}' | /usr/libexec/rpcd/ns.wireguard call set-peer
{"section": "wg1_user1_peer"}

some commit and restart:

root@NSec8-VM:~# uci commit network
root@NSec8-VM:~# reload_config

and then I can see the new account inside the configuration

config wireguard_wg1 'wg1_user1_peer'
        option public_key '3Kirpj+r70ZEng0ZLCp3/X8/V7rFHRGB+66SQ8SgDDw='
        option private_key 'WOepFqyNkpg3C5i+KxVxwMnBhkJn2m/W3/BCwrvg4Xg='
        option ns_ip '10.103.1.2'
        option persistent_keepalive '25'
        option description 'user1'
        option ns_link 'network/wg1'
        option route_allowed_ips '1'
        option disabled '0'
        option ns_route_all_traffic '0'
        option ns_client_to_client '0'
        list allowed_ips '10.103.1.2'
        option preshared_key 'KiXANB3TIisUgdlLvrC0EkxDCMy7SRiI2UqCk8oNmAk='

[gsanchietti]

Environment: Virtual machine going to internet through another firewall.

That's the issue: probably the firewall has DNS proxy configured that intercepts the request.

[cotosso]

TEST CASE for "Download the account configuration"

Everything went fine

root@NSec8-VM:~# echo '{"instance": "wg1", "account": "user1"}' | /usr/libexec/rpcd/ns.wireguard call download-peer-config | jq -r .config
# Account: user1 for wg1
[Interface]
PrivateKey = WOepFqyNkpg3C5i+KxVxwMnBhkJn2m/W3/BCwrvg4Xg=
Address = 10.103.1.2
# Custom DNS disabled

[Peer]
PublicKey = 10VNMyuL/4kZz2IGnxlCBFggtxgrXP1IifVZGfuoaBE=
PreSharedKey = KiXANB3TIisUgdlLvrC0EkxDCMy7SRiI2UqCk8oNmAk=
AllowedIPs = 192.168.100.0/24,10.103.1.1
Endpoint = 1.2.3.4:51820
PersistentKeepalive = 25

[cotosso]

TEST CASE for "Configure a Desktop/Mobile device"

Everything went fine:
QR code has been generated and correctly scanned/importaed by the wireguard android app.

[gsanchietti]

Released on 23.05.5-ns.1.4.0